CVE-2026-35280: Oracle WebCenter Privilege Escalation

CVE-2026-35280 Overview

CVE-2026-35280 is a critical vulnerability in the Oracle WebCenter Enterprise Capture product within Oracle Fusion Middleware. The flaw resides in the Client Bundle component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via T3 or IIOP protocols can exploit this issue to compromise the affected system. The vulnerability is classified under [CWE-284: Improper Access Control] and exhibits a scope change, meaning attacks can impact components beyond the vulnerable product itself. Successful exploitation results in full takeover of Oracle WebCenter Enterprise Capture.

Critical Impact
Successful exploitation enables complete takeover of Oracle WebCenter Enterprise Capture, with confirmed impacts on confidentiality, integrity, and availability. Scope change extends the blast radius to additional Fusion Middleware components.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-06-17 - CVE-2026-35280 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Oracle Critical Security Patch Update released

Technical Details for CVE-2026-35280

Vulnerability Analysis

The vulnerability stems from improper access control [CWE-284] in the Client Bundle component of Oracle WebCenter Enterprise Capture. Attackers exploit the issue over the network using Oracle's T3 or Internet Inter-ORB Protocol (IIOP) remote method invocation channels. These protocols are commonly used by WebLogic-based Fusion Middleware deployments for client-server communication. The flaw requires only low privileges and no user interaction. Exploitation crosses a trust boundary, allowing attackers to affect resources beyond the vulnerable product itself. The Exploit Prediction Scoring System (EPSS) currently ranks this issue in the 33rd percentile.

Root Cause

The root cause lies in insufficient access control enforcement within the Client Bundle component when handling remote requests over T3 and IIOP. Authenticated users with minimal privileges can invoke functionality that should require elevated authorization. The scope change indicator (S:C) confirms the vulnerable code path can manipulate resources owned by other security authorities within the Fusion Middleware deployment.

Attack Vector

Attackers send crafted requests to exposed T3 or IIOP listeners on the target WebCenter Enterprise Capture instance. T3 is Oracle WebLogic's proprietary remote protocol, while IIOP enables CORBA-based remote object invocation. Both protocols are frequently exposed in enterprise deployments for legitimate inter-service communication. An attacker with valid low-privilege credentials can pivot through these channels to seize control of the application server. No verified public proof-of-concept code is currently available. Refer to the Oracle Security Alert for vendor-supplied technical details.

Detection Methods for CVE-2026-35280

Indicators of Compromise

Unexpected T3 or IIOP connections to WebCenter Enterprise Capture listeners from non-administrative hosts or subnets.
Authentication events involving low-privileged accounts followed by administrative actions on the Capture server.
Anomalous Java process spawning or shell execution under the WebLogic managed server user.
New or modified deployment artifacts in the Capture domain directories without change-management records.

Detection Strategies

Monitor WebLogic access logs for unusual T3/IIOP method invocations targeting Capture Client Bundle classes.
Correlate authentication telemetry with subsequent privilege-sensitive operations on the same session.
Inspect network flow data for T3 (default port 7001) and IIOP traffic originating from unexpected sources.
Apply file integrity monitoring on Oracle Fusion Middleware home directories and Capture configuration files.

Monitoring Recommendations

Enable verbose WebLogic auditing for the Capture managed server and forward logs to a centralized SIEM.
Alert on T3/IIOP connections from outside defined administration networks.
Track JVM process behavior on the Capture host, including child process creation and outbound connections.
Review Oracle Platform Security Services (OPSS) audit records for unauthorized policy or credential changes.

How to Mitigate CVE-2026-35280

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected 12.2.1.4.0 and 14.1.2.0.0 deployments.
Restrict network access to T3 and IIOP listeners using firewall rules and WebLogic connection filters.
Audit and reduce the number of low-privileged accounts able to authenticate to the Capture environment.
Rotate credentials for any account that may have accessed the system prior to patching.

Patch Information

Oracle addressed CVE-2026-35280 in the June 2026 Critical Patch Update. Administrators should review the Oracle Security Alert for version-specific patch identifiers and apply fixes during the next available maintenance window. Test patches in a staging environment before production rollout to validate compatibility with custom Capture workflows.

Workarounds

Configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP from untrusted networks.
Disable IIOP entirely on managed servers where it is not required by application functionality.
Place WebCenter Enterprise Capture behind a reverse proxy or jump host that terminates only required protocols.
Enforce network segmentation isolating Fusion Middleware administrative interfaces from general user networks.

bash

# Example WebLogic connection filter rules to restrict T3/IIOP
# Set in WebLogic Console: Security > Filter > Connection Filter Rules
10.0.0.0/8   * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops